I recently attended a workshop about app/web product design. The presenter asked us to think of a well and badly designed app. Dash sprang to my mind as an example of the latter. While its design is an ongoing issue, it happened at least once that its server certificate expired and users couldn’t do payments.
We all have seen it – I go to visit an interesting blog, DEFCON website, or pay for your parking on the go. But I can’t – the website or web service has an expired certificate and the “damn security wouldn’t let me do it”.
When we researched impacts of the ROCA vulnerability, the Estonian government limited the impact with a cut-off date. ROCA only applied after that date. It now appears that Gemalto had another problem before that cut-off date.